Analysis
- max time kernel
101s - max time network
103s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/09/2021, 16:17
General
- Target 61e464bfa4f806a7805d2056171a8a7c.exe
- Size 75KB
- Sample210928-trjptscdfn
- SHA256 035ffcab1903dbf2f58155dfb50c14f2463e01fe9cf46baa4cf678f7e6b255ff
Malware Config
Extracted
-
redline
-
195.2.93.217:60468
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Turns off Windows Defender SpyNet reporting 2 TTPs
- Windows security bypass 2 TTPs
- Nirsoft 3 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 10 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61e464bfa4f806a7805d2056171a8a7c.exe"C:\Users\Admin\AppData\Local\Temp\61e464bfa4f806a7805d2056171a8a7c.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6876cd2d-7289-4c9f-bc5e-76d740842bef\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\6876cd2d-7289-4c9f-bc5e-76d740842bef\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6876cd2d-7289-4c9f-bc5e-76d740842bef\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6876cd2d-7289-4c9f-bc5e-76d740842bef\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\6876cd2d-7289-4c9f-bc5e-76d740842bef\AdvancedRun.exe" /SpecialRun 4101d8 11883⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\61e464bfa4f806a7805d2056171a8a7c.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\61e464bfa4f806a7805d2056171a8a7c.exe"C:\Users\Admin\AppData\Local\Temp\61e464bfa4f806a7805d2056171a8a7c.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\61e464bfa4f806a7805d2056171a8a7c.exe"C:\Users\Admin\AppData\Local\Temp\61e464bfa4f806a7805d2056171a8a7c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 22162⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/740-114-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/740-116-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/740-117-0x0000000005F10000-0x0000000005F11000-memory.dmp
memory/740-118-0x0000000005E70000-0x0000000005EE8000-memory.dmp
memory/740-119-0x00000000064B0000-0x00000000064B1000-memory.dmp
memory/1820-139-0x0000000007840000-0x0000000007841000-memory.dmp
memory/1820-169-0x0000000009AB0000-0x0000000009AB1000-memory.dmp
memory/1820-129-0x0000000007880000-0x0000000007881000-memory.dmp
memory/1820-370-0x0000000007380000-0x0000000007381000-memory.dmp
memory/1820-364-0x0000000007390000-0x0000000007391000-memory.dmp
memory/1820-174-0x0000000004EF3000-0x0000000004EF4000-memory.dmp
memory/1820-135-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/1820-136-0x0000000004EF2000-0x0000000004EF3000-memory.dmp
memory/1820-172-0x000000007F0D0000-0x000000007F0D1000-memory.dmp
memory/1820-128-0x0000000003460000-0x0000000003461000-memory.dmp
memory/1820-140-0x0000000007790000-0x0000000007791000-memory.dmp
memory/1820-141-0x0000000008030000-0x0000000008031000-memory.dmp
memory/1820-168-0x00000000096F0000-0x00000000096F1000-memory.dmp
memory/1820-163-0x0000000009580000-0x0000000009581000-memory.dmp
memory/1820-144-0x0000000008130000-0x0000000008131000-memory.dmp
memory/1820-156-0x00000000095A0000-0x00000000095D3000-memory.dmp
memory/1820-146-0x00000000084E0000-0x00000000084E1000-memory.dmp
memory/1820-148-0x0000000008880000-0x0000000008881000-memory.dmp
memory/2592-143-0x0000000005680000-0x0000000005681000-memory.dmp
memory/2592-142-0x0000000005680000-0x0000000005C86000-memory.dmp
memory/2592-138-0x0000000005790000-0x0000000005791000-memory.dmp
memory/2592-137-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/2592-134-0x0000000005C90000-0x0000000005C91000-memory.dmp
memory/2592-145-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/2592-130-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2592-380-0x0000000007080000-0x0000000007081000-memory.dmp
memory/2592-381-0x0000000007780000-0x0000000007781000-memory.dmp
memory/2592-389-0x0000000007370000-0x0000000007371000-memory.dmp
memory/2592-390-0x0000000007310000-0x0000000007311000-memory.dmp
memory/2592-392-0x0000000009150000-0x0000000009151000-memory.dmp